Fake QR Codes: How to Spot Them and Stay Safe

What a fake QR code is

Here is the uncomfortable technical truth: there is no such thing as a fake QR code. Every code that scans is a real, working QR code. What is fake is the destination. A scammer's code is technically identical to a legitimate one; it simply points to a phishing page, a payment form that pays the wrong person, or a lookalike login screen.

That distinction matters for defense. You cannot spot a scam by looking at the black-and-white pattern: the modules of a malicious code look exactly like the modules of an honest one. What you can inspect is the URL inside the code and the physical context around it. Every reliable defense below comes down to one of those two checks.

Security researchers call this attack quishing — QR phishing. It exploits the one thing QR codes do by design: hide a long URL behind a scannable square.

Where fake codes show up

Scammers put codes where scanning feels routine and urgency feels natural:

• Sticker overlays on parking meters and pay stations. The most reported real-world variant: a printed sticker pasted directly over the meter's genuine payment code, routing your card details to a fake payment page. Cities across the US and UK have issued warnings about exactly this.
• Restaurant tables and menus. A sticker over the venue's menu or review code sends diners to a phishing page dressed up as a menu, an ordering system, or a payment screen.
• Tampered posters and flyers. A legitimate event poster with the original code covered, or entirely fake flyers hung in high-traffic spots.
• Unsolicited mail and packages. A package you never ordered with a "scan to verify" code, or a letter claiming a missed delivery or unpaid toll: classic phishing with a QR code instead of a link, precisely because email filters read links but not images.
• Fake payment codes at checkout. In countries where QR payments are common, a swapped code at a till or market stall redirects the payment to the scammer's account.

The common thread: physical, unattended, and pointed at money or credentials.

How to check a QR code before you open it

The rule is simple: decode first, decide second.

• Read the camera preview. When you point your phone at a code, iOS and Android show the destination (or at least the domain) in a small banner before you tap. Actually read it. If the parking app should be paybyphone.com and the banner shows an unrelated or garbled domain, walk away.
• Use an in-browser decoder for the full URL. Camera previews often truncate. Photograph the code and upload it to the in-browser QR scanner. It decodes the image locally and shows you the complete URL inside, without opening it. This is the closest thing to hovering over a link before clicking.
• Know the red flags. A URL shortener on a payment or official request (a real toll authority does not route through a generic short link); lookalike domains (paypa1, amaz0n, a brand name buried in a subdomain of something unrelated); http instead of https on anything asking for input; and urgency language on the page ("pay within 10 minutes to avoid a fine").
• Check the physical code. Run a thumbnail over it. A sticker sitting on top of another sticker, bubbling edges, or a code that looks newer than the sign it is on are all reasons to stop and use the venue's website or app instead.

None of this requires technical skill — it is the same discipline as not clicking strange email links, applied to squares on posters.

If you already scanned one

Scanning by itself is rarely the damage — what you do on the page that opens is. If you suspect a code was fake:

1. Do not enter anything. No passwords, no card numbers, no personal details. Close the tab.
2. If you already entered credentials, change that password immediately, and everywhere you reuse it. Turn on two-factor authentication.
3. If you entered payment details, contact your bank or card issuer now; ask them to block the card and flag the transaction.
4. Report it. Tell the venue (they likely have no idea their meter or table code was covered), and report the scam to your bank and your country's fraud-reporting service.

Speed matters far more than embarrassment. Banks reverse far more fraud in the first hour than in the first week.

For businesses: protect your printed codes

If customers scan your codes, the sticker-overlay attack is aimed at your reputation. Practical countermeasures:

• Tamper-evident placement. Print codes directly on menus, laminate them, or put them behind acrylic: anything that makes a pasted sticker obvious. Avoid loose table tents that can be swapped wholesale.
• Walk your premises regularly. Add a weekly check of every public code to the opening checklist: does each one still scan, and does it still go where it should?
• Use branded, styled codes. A code in your brand colors with your logo in the center is dramatically harder to replace invisibly. A generic black-and-white sticker pasted over it looks instantly wrong to staff and customers. Style yours with the custom QR code generator.
• Use dynamic codes and watch the numbers. Dynamic QR codes report scan counts and locations. A code that suddenly drops to zero scans is a code that may be covered by someone else's sticker — analytics turns tampering into an alert instead of a months-later surprise.
• Print the URL under the code. A human-readable domain below the square lets careful customers verify the destination matches.

QR codes are safe by design — destinations aren't

Worth keeping perspective: the QR format itself is just data arranged in a grid. A code cannot install anything, drain an account, or read your phone by being scanned. It only carries text, usually a URL, that your phone shows you before acting on. The risk lives entirely in where that URL leads, which makes QR safety the same skill as link safety: read before you tap, verify domains on anything involving money or logins, and be suspicious of urgency. Do that — the safe scanning walkthrough covers the habit step by step — and QR codes are no more dangerous than any other link you choose to click.